Date: Tue, 4 Feb 2025 14:30:43 +0200
From: Timo Teras <timo.teras@iki.fi>
To: John Hallam <sw@j.hallam.dk>
Cc: ~alpine/apk-tools@lists.alpinelinux.org
Subject: Re: [PATCH] libfetch: allow tolerant date parsing
Message-ID: <20250204143043.1f37d794@onyx.my.domain>
In-Reply-To: <Z6H7YCJsDGaH33NF@umbriel.sconet>
References: <Z6H7YCJsDGaH33NF@umbriel.sconet>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Tue, 4 Feb 2025 12:34:56 +0100
John Hallam <sw@j.hallam.dk> wrote:

> apk's libfetch is strict when interpreting timestamps in
> e.g. Last-Modified headers;  other tools and web servers (e.g.
> Debian's apt-cacher-ng) are lax in generation.

I was about to ask why not change apt-cacher-ng instead if they are
broken...

> The patch below fixes interaction with apt-cacher-ng and allows easy
> adding of other obsolete timestamp patterns.

... but went on to read the spec and it says at
https://datatracker.ietf.org/doc/html/rfc2616#section-3.3.1

   HTTP/1.1 clients and servers that parse the date value MUST accept
   all three formats (for compatibility with HTTP/1.0), though they MUST
   only generate the RFC 1123 format for representing HTTP-date values
   in header fields.

So I hope tyou file an issue against apt-cacher-ng to fix their thing.

But sounds like libfetch needs fixing too. If going here, it would be
good to support all three formats. And have the commit message reflect
that these are obsolete formats but required to be support for
standards compliance.

Would you like to update the patch accordingly, or prefer me to do the
additional changes?

Timo


> 
> Built and tested with apk-tools 2.14.9.
> 
> Best wishes
> 
>      John Hallam
> 
> 
> --- a/libfetch/http.c
> +++ b/libfetch/http.c
> @@ -479,11 +479,21 @@
>  {
>  	char *locale, *r;
>  	struct tm tm;
> +        int i;
> +	/* XXX should add support for date-2 and date-3 */
> +	const char *fmts[] ={ "%a, %d %b %Y %H:%M:%S GMT",
> +			      "%a %b %d %H:%M:%S %Y",
> +			      NULL,	
> +	};
>  
>  	locale = strdupa(setlocale(LC_TIME, NULL));
>  	setlocale(LC_TIME, "C");
> -	r = strptime(p, "%a, %d %b %Y %H:%M:%S GMT", &tm);
> -	/* XXX should add support for date-2 and date-3 */
> +	i=0;
> +	while(fmts[i] != NULL) {
> +		r = strptime(p, fmts[i], &tm);
> +		if(r != NULL) break;
> +		i++;
> +	}
>  	setlocale(LC_TIME, locale);
>  	if (r == NULL)
>  		return (-1);